Root cause positioning method, system and device

Abstract

The embodiment of the invention provides a root cause positioning method, system and device, and the method comprises the steps: obtaining historical link data corresponding to a micro-service business, and determining a target abnormity positioning model corresponding to the historical link data; determining a to-be-processed link data set corresponding to the micro-service business, clustering the to-be-processed link data set, and determining clustering center link data according to a clustering result; inputting the clustering center link data into a target abnormity positioning model to obtain abnormal link node information corresponding to the clustering center link data; and determining a target abnormal link corresponding to the micro-service based on the abnormal link node information, and determining an abnormal link node in the target abnormal link. Model fine tuning is carried out on the basis of the initial anomaly positioning model, so that the initial anomaly positioning model has relatively wide applicability and relatively strong generalization ability; and cluster center link data is selected to carry out root cause positioning, so that the root cause positioning speed of the micro-service business is improved.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular to a root cause location method. Background Art

[0002] With the development of computer technology, microservices on the cloud are developing rapidly. Microservice architecture is a highly scalable, highly available, and easy to maintain and update service architecture. Due to its faster delivery, better scalability, and greater autonomy, more and more systems use microservice architecture. As microservice architecture becomes increasingly popular, the security issues of microservices are also receiving much attention.

[0003] In the prior art, the work on microservice performance debugging is based on correlation, empirical thresholds or non-scalable algorithms and deep learning models, which results in low accuracy and slow speed. When microservices are expanded, the algorithms that locate the root cause based on experience and rules become unreliable or even unable to locate the root cause. Therefore, new methods are needed to locate the root cause of the fault when a fault occurs. The method of locating the root cause based on experience and rules is not universal, so an effective root cause location method is urgently needed to solve the above problems. Summary of the invention

[0004] In view of this, an embodiment of this specification provides a root cause location method. One or more embodiments of this specification also relate to a root cause location device, a root cause location system, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0005] According to a first aspect of an embodiment of this specification, a root cause location method is provided, including:

[0006] Obtain historical link data corresponding to the microservice business, and determine a target anomaly location model corresponding to the historical link data;

[0007] Determine a link data set to be processed corresponding to the microservice business, cluster the link data set to be processed, and determine cluster center link data according to the clustering result;

[0008] Inputting the cluster center link data into the target anomaly positioning model to obtain abnormal link node information corresponding to the cluster center link data;

[0009] A target abnormal link corresponding to the microservice business is determined based on the abnormal link node information, and an abnormal link node is determined in the target abnormal link.

[0010] According to a second aspect of an embodiment of this specification, a root cause positioning device is provided, including:

[0011] An acquisition module is configured to acquire historical link data corresponding to the microservice business and determine a target anomaly location model corresponding to the historical link data;

[0012] A clustering module is configured to determine a data set of links to be processed corresponding to the microservice business, cluster the data set of links to be processed, and determine cluster center link data according to the clustering result;

[0013] An input module is configured to input the cluster center link data into the target anomaly positioning model to obtain abnormal link node information corresponding to the cluster center link data;

[0014] The determination module is configured to determine a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine an abnormal link node in the target abnormal link.

[0015] According to a third aspect of the embodiments of this specification, a root cause positioning system is provided, including a server and a client;

[0016] The client submits an exception location request to the server for the target microservice business;

[0017] The server parses the abnormality location request to obtain debugging link data and target link data; updates the initial abnormality location model to the abnormality location model to be used based on the debugging link data; clusters the target link data, and determines the link data to be input according to the clustering result; inputs the link data to be input into the abnormality location model to be used, and obtains abnormal node information corresponding to the target microservice business; determines the abnormal node based on the abnormal node information, and generates abnormal feedback information based on the abnormal node and the abnormal node information; and sends the abnormal feedback information to the client as a response to the abnormal location request;

[0018] The client performs exception processing on the target microservice business based on the exception feedback information.

[0019] According to a fourth aspect of an embodiment of this specification, a computing device is provided, including:

[0020] Memory and processor;

[0021] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the above-mentioned root cause location method are implemented.

[0022] According to a fifth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned root cause locating method are implemented.

[0023] According to a sixth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned root cause locating method.

[0024] One embodiment of the present specification obtains historical link data corresponding to a microservice business and determines a target anomaly location model corresponding to the historical link data; determines a to-be-processed link data set corresponding to the microservice business, clusters the to-be-processed link data set, and determines cluster center link data according to the clustering result; inputs the cluster center link data into the target anomaly location model to obtain abnormal link node information corresponding to the cluster center link data; determines the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determines the abnormal link node in the target abnormal link. Fine-tune the model based on the initial anomaly location model, so that the adjusted initial anomaly location model is applicable to a specific microservice business, so that the initial anomaly location model has a wider applicability and stronger generalization ability; when performing root cause location through the target anomaly location model, select the cluster center link data for root cause location to improve the root cause location speed of the microservice business. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a structural schematic diagram of a root cause location method provided by an embodiment of this specification;

[0026] Figure 2 is a flow chart of a root cause location method provided by an embodiment of this specification;

[0027] Figure 3 is a process flow chart of a root cause location method provided by an embodiment of this specification;

[0028] Figure 4 It is a schematic diagram of a model training of a root cause location method provided by an embodiment of this specification;

[0029] Figure 5 It is a schematic diagram of a model application of a root cause location method provided by an embodiment of this specification;

[0030] Figure 6 It is a microservice synthesis schematic diagram of a root cause location method provided by an embodiment of this specification;

[0031] Figure 7 is a schematic diagram of the structure of a root cause locating device provided by an embodiment of this specification;

[0032] Figure 8 is an architecture diagram of a root cause location system provided by an embodiment of this specification;

[0033] Fig. 9 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0034] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0035] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0036] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0037] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0038] First, the terms involved in one or more embodiments of this specification are explained.

[0039] Trace: Link tracking starts from the moment a request is initiated by the client and reaches the boundary of the system. It records every service that the request passes through until a response is returned to the client. This entire process is called a "trace".

[0040] Span: In a distributed system, the trace link is used to record the call status of a request between multiple services, including the starting point, end point and services passed through in the middle. Span is the basic unit in the trace link, which represents the process of a service processing a request, including the service receiving the request, processing the request, returning the response, etc. Specifically, each span contains a unique identifier (Span ID), the identifier of the parent span (Parent ID), the start time, the end time, the span duration, the operation name of the span, the span label and other information. When a request passes through a service, the service creates a new span object and sets its span ID to the ID of the parent span and the start time to the current time. When the service completes the request processing, it sets the end time to the current time and sends the span information to the trace link so that subsequent services can obtain this information.

[0041] MicroService: Microservice is an architectural and organizational approach to developing software in which the software consists of small independent services that communicate through well-defined APIs.

[0042] Few-shot Learning: Few-shot learning refers to a machine learning task that generalizes and recognizes new data by learning the characteristics or rules of a small number of data samples when there is only a small amount of labeled data. Traditional machine learning models require a large amount of labeled data to train the model, while Few-shot learning can learn with very little data and achieve good results, and has high application value.

[0043] SBert-SBERT: Sentence-BERT is a pre-trained model based on BERT, which is mainly used to generate vector representations of text, especially for calculating the similarity between sentences. Unlike the traditional BERT model that only takes text sequences as input, SBERT introduces some special training techniques based on BERT, such as sentence pair construction, multi-task learning, etc., so that the model can learn more about the semantics of sentences in the pre-training stage and encode it into a fixed-length vector representation. This vector representation can be used to calculate the similarity between sentences, such as cosine similarity, Manhattan distance, etc., so as to achieve tasks such as text matching, semantic search, and sentiment analysis.

[0044] Counterfactuals: refers to the reverse inference of what has happened, that is, assuming that the event that has happened is different, opposite or has not happened, and then observing the results under these assumptions. In simple terms, it is a way of thinking "If that thing did not happen in this way, what would the result be?" This way of thinking can help people better understand and analyze the events that have happened, and draw some valuable conclusions and lessons from them, and it can also help people predict and avoid problems that may arise in the future.

[0045] GNN: (Graph Neural Network, GNN), graph neural network, is a deep learning model based on graph structure, mainly used to process graph data. In layman's terms, it is to use deep learning methods to analyze and process graph data. For example, we can regard data such as friend relationships in social networks, transportation routes in logistics, and molecular structures in chemical reactions as graph data. Graph neural networks can learn the features and relationships in these graph data, so as to classify, cluster, and predict nodes and edges in the graph. Unlike traditional models such as convolutional neural networks and recurrent neural networks, graph neural networks are mainly designed and optimized based on graph structures and graph algorithms in graph theory, and have some unique operations, such as graph convolution and graph attention mechanisms. Through these operations, graph neural networks can effectively process different types of graph data and have achieved many successful applications in various tasks, such as node classification, graph classification, link prediction, etc.

[0046] GIN: Graph Isomorphism Network (GIN), a graph isomorphism network, is a graph neural network. It is an improved algorithm based on graph convolutional neural network (GCN) proposed by Xu et al. The goal of GIN is to classify, cluster, and reconstruct graphs by learning the local neighborhood substructure between nodes.

[0047] Jaccard index: Jaccard index is an indicator used to calculate the similarity between two sets, and its value is between 0 and 1. It is defined as the size of the intersection of two sets divided by the size of their union, that is, J(A, B) = |A∩B| / |A∪B|, where A and B are two sets, and |A| represents the size of set A (the number of elements). The Jaccard index can be used to evaluate the similarity between two sets in terms of elements. The closer the value is to 1, the higher the similarity between the two sets, and the closer the value is to 0, the lower the similarity between the two sets. In practical applications, the Jaccard index is often used in text processing, image processing, data mining and other fields. For example, it is used to calculate the similarity between queries and documents in search engines, or to calculate the similarity between different clusters in cluster analysis.

[0048] With the development of computer technology, microservices on the cloud are developing rapidly. Microservice architecture is a highly scalable, highly available, and easy to maintain and update service architecture. Due to its faster delivery, better scalability, and greater autonomy, more and more systems use microservice architecture. With the increasing popularity of microservice architecture, the security issues of microservices have also attracted much attention. The continuous expansion of microservice scale makes the RPC dependency graph complex, exacerbates the tail-of-scale effect, and makes many empirical rules unreliable. Previous work on microservice performance debugging is based on correlation, empirical thresholds, or non-scalable algorithms and deep learning models. None of them use microservice benchmarks with comparable production service scales for quantitative evaluation, making their accuracy and performance questionable in production-scale microservices. When microservices scale, many heuristic methods for root cause analysis algorithms based on experience and rules become unreliable or even unverifiable. In a microservice architecture, since different services may run on different nodes and the communication between them may be affected by factors such as network latency and packet loss, new methods are needed for fault analysis and resolution when faults occur. In this case, more advanced data analysis techniques and tools are needed to help identify and fix the failure.

[0049] In the prior art, the work on microservice performance debugging is based on correlation, empirical thresholds or non-scalable algorithms and deep learning models, resulting in low accuracy and slow speed. When microservices are expanded, the algorithms that locate the root cause based on experience and rules become unreliable or even unable to locate the root cause. Therefore, new methods are needed to locate the root cause of the fault when a fault occurs. In order to perform root cause diagnosis on the trace data of microservices in a production environment and improve the efficiency of problem solving, this embodiment provides a root cause location method.

[0050] Figure 1 FIG. 2 shows a schematic diagram of a root cause location method according to an embodiment of the present specification; Figure 1 As shown, in the microservice business scenario, the historical link data corresponding to the microservice business is obtained, and the target abnormality location model for root cause location is determined. The target abnormality location model can be obtained by fine-tuning the initial abnormality location model using the historical link data as a training sample, that is, the initial abnormality location model is updated based on the historical link data to obtain the target abnormality location model. Determine the link data set to be processed corresponding to the microservice business, cluster the link data set to be processed, and determine the cluster center link data according to the clustering results. Input the cluster center link data into the target abnormality location model to obtain the abnormal link node information corresponding to the cluster center link data. Determine the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine the abnormal link node in the target abnormal link. Realize the root cause location of the link data to be processed.

[0051] The model is fine-tuned based on the initial anomaly localization model, so that the adjusted initial anomaly localization model is suitable for specific microservice businesses, making the initial anomaly localization model have wider applicability and stronger generalization ability; when locating the root cause through the target anomaly localization model, the cluster center link data is selected for root cause localization to improve the root cause localization speed of the microservice business.

[0052] In this specification, a root cause locating method is provided. This specification also relates to a root cause locating apparatus, a root cause locating system, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0053] See also Figure 2 , Figure 2 A flow chart of a root cause location method provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0054] Step S202: Acquire historical link data corresponding to the microservice business, and determine a target anomaly location model corresponding to the historical link data.

[0055] Specifically, microservices are an architecture and organizational method for developing software, in which the software consists of small independent services that communicate through clearly defined APIs; accordingly, microservice business is a business based on the microservice architecture, and the types of services include but are not limited to computing, storage, etc.; historical link data refers to the trace data generated under the microservice business; the target anomaly location model corresponds to the microservice business and has the ability to identify abnormal data in the link data corresponding to the microservice business.

[0056] Based on this, the microservice business in the target domain is determined, and a small amount of link data generated under the microservice business is obtained as historical link data. Model training is performed based on a small amount of historical link data, so that the target anomaly location model obtained by training matches the microservice business in the target domain. The target anomaly location model can identify anomalies in the link data generated under the microservice business in the target domain and locate the root cause of the anomaly.

[0057] In practical applications, when determining the target anomaly location model, you can first obtain an initial anomaly location model with anomaly recognition capabilities, and then train the initial anomaly location model based on the acquired historical link data to obtain a target anomaly location model corresponding to the field of the microservice business. In addition, when determining the target legacy location model, you can also build a training set based on the acquired historical link data corresponding to the microservice business, build an initial anomaly location model for anomaly location, and then train the initial anomaly location model based on the training set until you get a target anomaly location model that meets the training stop condition.

[0058] Furthermore, in order to make the target anomaly location model have better anomaly location capability, training can be performed on the basis of the initial anomaly location model to obtain the target anomaly location model. The initial anomaly location model is a prediction model with anomaly detection and root cause location capabilities. Considering the generalization ability of the initial location model, it is possible to consider using rich training samples when training the model, and obtain link data corresponding to at least two initial microservice businesses to construct a link data sample set. The specific implementation is as follows:

[0059] The initial anomaly location model is updated to a target anomaly location model corresponding to the historical link data; wherein the training of the initial anomaly location model comprises: determining a link data set to be trained based on at least two initial microservice businesses; constructing a link data sample set based on at least two link data to be trained contained in the link data set to be trained; and using the link data sample set to train the anomaly location model to be trained until an initial anomaly location model that meets the training stop condition is obtained.

[0060] Specifically, the initial microservice business can be a microservice business in any business scenario, and the business scenario can be a computing business or a storage business, etc.; the link data set to be trained refers to a data set composed of link data corresponding to the collected initial microservice business; the link data sample set refers to a sample set used for model training; accordingly, the initial anomaly location model is an anomaly location model with the root cause location capability after the anomaly location model to be trained is trained based on the link data sample set. When collecting link data samples contained in the link data sample set, there can be multiple sampling methods. For example: for any microservice system, it is necessary to divide the trace data within a certain period of time according to different microservice entrances, calculate the distribution of the overall delay of each service entrance trace during this period, sample these trace data according to the calculated delay distribution, and then obtain the complete original training data; the initial anomaly location model is used to locate the root cause of the trace data and determine the root cause node of the anomaly in the trace data; the target anomaly location model refers to the anomaly location model obtained after updating the initial anomaly location model, and the historical link data is used to adjust the initial anomaly location model so that the target anomaly location model has the ability to identify abnormal data in the link data corresponding to the microservice business.

[0061] Based on this, at least two initial microservice businesses are determined, and the link data in each initial microservice business is collected respectively to construct a link data set to be trained. At least two link data to be trained contained in the link data set to be trained are determined, and each link data to be trained is processed respectively to obtain link data samples corresponding to the link data to be trained to form a link data sample set. The link data sample set is used to train the anomaly location model to be trained, and causal modeling of the link data samples based on the anomaly location model to be trained is realized. The link data samples are embedded and encoded using the anomaly location model to be trained, and then the anomaly location model to be trained is trained through a specific loss function, so that the anomaly location model to be trained learns the embedded features until an initial anomaly location model that meets the training stop condition is obtained.

[0062] Determine the initial anomaly location model, and update the initial anomaly location model based on a small amount of historical link data so that the updated initial anomaly location model matches the microservice business in the target domain. Update the initial anomaly location model to the target anomaly location model. This enables the target anomaly location model to identify anomalies in the link data generated by the microservice business in the target domain and locate the root cause of the anomaly.

[0063] In practical applications, the initial anomaly location model is trained based on the link data of multiple microservice businesses in multiple fields, so the initial anomaly location model has strong generalization ability. When using the initial anomaly location model for anomaly location, the initial anomaly location model can be fine-tuned based on the link data under different microservice businesses, so as to use the fine-tuned initial anomaly location model to locate the root cause of the link data. When performing root cause location and abnormal root cause analysis, a counterfactual method can be used. Counterfactual query is what is the expected tracking duration and error state if certain spans are restored to normal under certain circumstances. In other words, this query is based on a hypothetical situation, that is, assuming that certain spans are in a normal state, how will the entire system operate. The initial anomaly location model uses an iterative method to restore the service to a normal state, predict the counterfactual tracking state, and check whether it is predicted to be a normal state, so as to locate the root cause of the anomaly.

[0064] For example, determine the initial microservice business for providing computing services and the initial microservice business for providing storage services, obtain the link data of each microservice business, and build a link data sample set. Use the link data sample set to train the GNN-based anomaly localization model to be trained until an initial anomaly localization model that meets the training stop condition is obtained.

[0065] To summarize, a link data sample set for training the anomaly location model to be trained is constructed based on the link data of at least two initial microservice businesses, so that the anomaly location model to be trained can adapt to various types of microservice businesses, and the trained anomaly location model to be trained has better generalization ability.

[0066] Furthermore, considering that the link data of the microservice business contains multiple types of data such as type, start time, end time, status, etc., when training the anomaly location model based on the link data, considering the prediction ability of the model, various types of data in the link data can be fully utilized. The specific implementation is as follows:

[0067] The link data to be trained is converted into a text vector, and the time information and state information of the link data to be trained are determined; the text vector is updated based on the time information and the state information, and a link data sample corresponding to the link data to be trained is constructed based on the updated text vector.

[0068] Specifically, the text vector can be understood as the embedded feature representation of the link data to be trained, and the generation of the text vector can adopt various methods such as the Bert model; the time information can include the start time, end time, time consumption and other information of the link data to be trained; the state information can be determined based on the link data to be trained, that is, the state code or link state contained in the link data to be trained is used as the state information. The time information can also be the start time, end time, and exclusive time corresponding to the link node contained in the link data to be trained; the state information can be the node state information of the link node contained in the link data to be trained.

[0069] Based on this, the link data to be trained is converted into a text vector through a coding model or a coding algorithm. The time information and state information of the training link data are determined. The text vector is updated based on the time information and the state information, and the time information and the state information are integrated into the text vector. The link data sample corresponding to the link data to be trained is constructed based on the updated text vector.

[0070] Continuing with the above example, the Bert model or SBert model is used to convert the link data to be trained into a text vector. Based on the start time and end time of the span in the link data to be trained, the exclusive time of the span is calculated as the time information corresponding to the link data to be trained. When calculating the exclusive time of a span, the relationship between the parent and child spans also needs to be considered. If a span is a child span of its parent span, then its exclusive time should be the sum of the time of its parent span minus the time of the child span. If a span starts at T1 and ends at T2, and it has two child spans with start times of T3 and T4 and end times of T5 and T6, then the exclusive time of the span is (T2-T1)-(T5-T3)-(T6-T4).

[0071] In summary, the time information and state information of the link data are integrated into the link data to be trained, so that the anomaly location model is trained using the link data to be trained, thereby improving the prediction accuracy of the anomaly location model.

[0072] Furthermore, considering that the training cost of the initial anomaly localization model is high, in order to improve the utilization rate of the initial anomaly localization model, a more common method is to improve the generalization ability of the initial anomaly localization model so that the initial anomaly localization model has higher applicability. The specific implementation is as follows:

[0073] Determine at least two initial microservice businesses; collect at least two link data corresponding to the at least two initial microservice businesses according to a preset data collection strategy; divide the at least two link data corresponding to the at least two initial microservice businesses according to a preset data division rule, and determine a subset of link data to be trained corresponding to each initial microservice business according to the division result; and construct a link data set to be trained based on the at least two subsets of link data to be trained.

[0074] Specifically, the data collection strategy can be to collect data through data collection tools, or to obtain data through manual collection; the data division rule can be to divide according to the data collection time or the data generation time, or to divide according to the data type, and the data type can be either computing data or storage data.

[0075] Based on this, at least two initial microservices of various types such as traffic nodes, disk IO intensive nodes, and computing intensive nodes are determined. At least two link data corresponding to the at least two initial microservices are collected according to a preset data collection strategy. The at least two link data corresponding to the at least two initial microservices are divided according to a preset data division rule, and a subset of link data to be trained corresponding to each initial microservice is determined according to the division result; and a link data set to be trained is constructed based on at least two subsets of link data to be trained.

[0076] Using the above example, select the microservice business that needs to collect data from various types of microservice businesses, such as traffic nodes, disk IO-intensive nodes, and computing-intensive nodes, and obtain the link data generated by each microservice business. Perform data division on the link data generated by each microservice business to achieve data classification. Then, determine the link data subset corresponding to each microservice business based on the classification results, and construct link data sets to be trained of various data set types based on each link data subset.

[0077] In summary, a link data set to be trained is constructed based on the link data of at least two initial microservice businesses, so as to enrich the data types and business types in the link data set to be trained. After training the training anomaly location model, the generalization ability of the model and the prediction accuracy of the model are improved.

[0078] Furthermore, considering the complexity of the data structure of the link data to be trained, the various types of data in the link data to be trained can be integrated, so that when the anomaly localization model is trained later, the anomaly localization model can fully learn the characteristics of the sample data and improve the prediction ability of the anomaly localization model. The specific implementation is as follows:

[0079] The link data to be trained is encoded, and a text vector corresponding to the link data to be trained is determined according to the processing result; the start time and the end time of the sub-link data contained in the link data to be trained are calculated, and the time information corresponding to the link data to be trained is determined according to the calculation result; and the sub-state information of the sub-link data contained in the link data to be trained is used as the state information of the link data to be trained.

[0080] Based on this, the SBert model is used to encode the link data to be trained, and the text vector corresponding to the link data to be trained is determined according to the processing result. The sub-link data contained in the link data to be trained is determined, and the exclusive time of the sub-link data is calculated according to the start time and end time of the sub-link data, and the exclusive time of the sub-link data contained in the link data to be trained is used as the time information of the link data to be trained. The sub-state information of the sub-link data contained in the link data to be trained is used as the state information of the link data to be trained.

[0081] Following the above example, encode the service and name in the trace data with semantic information (converted into a 768-dimensional vector using SBert). When encoding, remove special characters, hexadecimal encoding, and convert uppercase and lowercase letters uniformly. Calculate the exclusive time of the span (sub-link data). The duration of the synchronization span of a non-leaf node includes the time spent in the service and the waiting time of its subspans. Separate the duration from the waiting time to locate the root cause of the high-latency trace.

[0082] In summary, various types of data such as time information and state information in the training link data are integrated, so that when the anomaly localization model is trained later, the anomaly localization model can fully learn the characteristics of the sample data and improve the prediction ability of the anomaly localization model.

[0083] Step S204: determining a link data set to be processed corresponding to the microservice business, clustering the link data set to be processed, and determining cluster center link data according to the clustering result.

[0084] Specifically, after obtaining the historical link data corresponding to the microservice business and updating the initial anomaly location model to the target anomaly location model based on the historical link data, the link data set to be processed corresponding to the microservice business can be determined, and the link data set to be processed can be clustered, and the clustering center link data can be determined according to the clustering results, wherein the link data set to be processed refers to a link data set obtained by collecting link data for the microservice business; the link data set to be processed contains link data with abnormalities; the clustering method can use the DBSCAN algorithm, k-means algorithm, etc., and this embodiment does not impose any restrictions on this; the clustering center link data refers to the link data of the cluster center to be processed obtained after clustering the link data set to be processed, which is used to be input into the target anomaly location model for anomaly detection.

[0085] Based on this, after obtaining the historical link data corresponding to the microservice business and updating the initial anomaly location model to the target anomaly location model based on the historical link data, the link data of the microservice business is collected, and the link data collection strategy is used to collect the link data corresponding to the microservice business as the link data set to be processed. Determine the distance index corresponding to the link data to be processed, cluster the link data set to be processed based on the distance index, and determine the cluster center link data according to the clustering result.

[0086] In practical applications, a span identifier consists of its label: a (service, name, kind) tuple, its error state, and the labels of all ancestor spans within a maximum distance of d_max to reflect the structure and state of a given trace. Different spans that share the same identifier are merged in a set, with a weight equal to the sum of their durations. When the structure and execution state of two traces are similar, identical elements with similar weights can be found in the two trace sets. We use the extended Jaccard index to calculate the similarity of trace sets. Use the DBSCAN algorithm for clustering to obtain trace clusters with similar structures, and find representative (cluster center) trace links from them as trace links for root cause analysis.

[0087] Step S206: input the cluster center link data into the target anomaly positioning model to obtain the abnormal link node information corresponding to the cluster center link data.

[0088] Specifically, after determining the to-be-processed link data set corresponding to the microservice business, clustering the to-be-processed link data set, and determining the cluster center link data according to the clustering result, the cluster center link data can be input into the target anomaly positioning model to obtain the abnormal link node information corresponding to the cluster center link data, wherein the abnormal link node information refers to the abnormal description information or abnormal node description information, for example: the abnormal description information is recording type A data, and accordingly, the abnormal link node is the node recording type A data; the abnormal description information is recording data B (data or string), and accordingly, the abnormal link node is the node recording data B. The abnormal link node information can be the abnormal information contained in the cluster center link data, and the abnormal types include but are not limited to data abnormality, label abnormality, state abnormality, time abnormality, and resource abnormality.

[0089] Based on this, after determining the to-be-processed link data set corresponding to the microservice business, clustering the to-be-processed link data set, and determining the cluster center link data according to the clustering results, the cluster center link data is input into the target anomaly location model, and the target anomaly location model uses the counterfactual method to locate the root cause of the cluster center link data, and the target anomaly location model outputs the abnormal link node information corresponding to the cluster center link data. Then, anomaly analysis and fault recovery are performed based on the abnormal link node information.

[0090] In practical applications, the target anomaly location model can be an anomaly location model obtained by using the GNN model to perform causal modeling on the trace data. CBN (Causal Bayesian Networks, a causal inference network based on Bayesian theory) is used to characterize the propagation of error information in the trace data, and GIN (Graph Isomorphism Network) is used to embed the trace link data, and learning is performed through a specific loss function to finally complete the learning of the embedded features. The loss function can be the following formula (1):

[0091]

[0092] Among them, d i Indicates the time taken by Span; Indicates the exclusive time of Span; e i Indicates the error state of Span; This means that during the error propagation process of the parent span, the error of the parent span itself, the duration of the child span, and the error status need to be considered, and the largest value is selected as the error of the parent span. This ensures that the error can be correctly propagated along the causal DAG (directed acyclic graph).

[0093] Furthermore, when determining the link data to be processed corresponding to the microservice business, considering the convenience and accuracy of data acquisition, the existing data collection technology can be used to implement data collection, which is specifically implemented as follows:

[0094] At least two pieces of to-be-processed link data corresponding to the microservice business are acquired based on a preset data acquisition strategy; and a to-be-processed link data set is constructed using the at least two pieces of to-be-processed link data.

[0095] Based on this, according to OpenTelemetry (distributed link tracking standard) and link data collection tools, link data collection of microservice business is realized, and at least two link data to be processed corresponding to the microservice business are obtained based on the preset data acquisition strategy. At least two link data to be processed are stored in the data set to build the link data set to be processed.

[0096] Using the above example, OpenTelemetry consists of a set of APIs and SDK tools to observe, generate, collect, and export various observable data. When collecting link data of microservices, use OpenTelemetry to collect trace data of microservices. Store the collected trace data in a collection to build a link data set to be processed.

[0097] In summary, the link data to be processed corresponding to the microservice business is obtained through the preset data acquisition strategy, thereby improving the efficiency and accuracy of link data acquisition.

[0098] Furthermore, considering the large amount of link data under microservice business, it will consume a lot of computing resources and processing time to perform anomaly detection and root cause location on each link data. In order to improve the efficiency of anomaly detection and root cause location, the cluster center link data can be determined by clustering the link data to be processed, so that only the cluster center link data is input into the target anomaly location model. The specific implementation is as follows:

[0099] Determine the link data to be processed contained in the link data set to be processed; cluster the link data set to be processed according to the data structure, link state and time weight of each link data to be processed in the link data set to be processed, and determine the cluster center link data according to the clustering result.

[0100] Specifically, clustering refers to the process of dividing a collection of physical or abstract objects into multiple classes consisting of similar objects. The clusters generated by clustering are a collection of data objects that are similar to objects in the same cluster and different from objects in other clusters. Clustering can be achieved through clustering algorithms such as the k-means algorithm and the DBSCAN algorithm.

[0101] Based on this, the link data set to be processed contains at least two link data to be processed. The link data set to be processed is clustered according to the name label, type label and other data structures, link status and time weight of each link data to be processed in the link data set to be processed, and at least one cluster center link data is determined according to the clustering result.

[0102] Continuing with the above example, the span identifier consists of a label: (Service, name, kind) tuple, as well as the error state and the labels of all ancestor spans within the maximum distance, reflecting the structure and state of a given trace. Different spans that share the same identifier are merged in a set with a weight equal to the sum of their durations. When the structure and execution state of two traces are similar, identical elements with similar weights can be found in the two trace sets. We use the extended Jaccard index to calculate the similarity of trace sets. Use the DBSCAN algorithm for clustering to obtain trace clusters with similar structures, and find representative (cluster center) trace links from them as trace links to be analyzed for root cause.

[0103] In summary, by clustering the link data set to be processed, the cluster center link data is determined according to the clustering results, and then the cluster center link data is input into the target anomaly positioning model to determine the abnormal link nodes, thereby improving the efficiency of anomaly detection and root cause positioning and reducing the consumption of computing resources and time.

[0104] Step S208: Determine a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine an abnormal link node in the target abnormal link.

[0105] Specifically, after the cluster center link data is input into the target anomaly positioning model and the abnormal link node information corresponding to the cluster center link data is obtained, the target abnormal link corresponding to the microservice business can be determined based on the abnormal link node information, and the abnormal link node can be determined in the target abnormal link, wherein the target abnormal link refers to the microservice business link corresponding to the abnormal link node information; since the target abnormal link contains at least one link node, the abnormal link node is a node with an abnormality in the target abnormal link.

[0106] Based on this, after the cluster center link data is input into the target anomaly location model and the abnormal link node information corresponding to the cluster center link data is obtained, the target abnormal link data corresponding to the microservice business is determined based on the abnormal link node information, the target abnormal link is determined based on the target abnormal link data, and the abnormal link node is determined in the target abnormal link. This facilitates subsequent abnormal analysis and abnormal processing of the target abnormal link node to achieve abnormal recovery.

[0107] Furthermore, considering that the abnormal link node information contains attribute information such as the abnormal link identifier, the target abnormal link data is preferentially determined before determining the target abnormal link, which is specifically implemented as follows:

[0108] Based on the abnormal link node information, target abnormal link data is determined in the link data set to be processed; based on the target abnormal link data, a target abnormal link corresponding to the microservice business is determined; based on the abnormal link node information, an abnormal link node is determined in the target abnormal link.

[0109] Specifically, the target abnormal link data refers to the link data with abnormalities in the link data set to be processed. The abnormal data in the target abnormal link data may be of various types, including but not limited to data anomalies, label anomalies, state anomalies, time anomalies, and resource anomalies.

[0110] Based on this, the target abnormal link data corresponding to the abnormal link node information with abnormalities is determined in the link data set to be processed based on the abnormal link node information. The target abnormal link matching the target abnormal link data in the microservice business is determined based on the target abnormal link data. The abnormal link node is determined in the target abnormal link based on the abnormal node information contained in the abnormal link node information.

[0111] Using the above example, the abnormal link node information may be a link tag containing an abnormal link, a link node tag that generates an abnormality in the abnormal link, and the target abnormal link data corresponding to the abnormal link node information with an abnormality is determined in the link data set to be processed according to the link tag contained in the abnormal link node information. The target abnormal link A corresponding to the target abnormal link data is determined, and the link node a that generates an abnormality is determined in the target abnormal link A according to the link node tag that generates an abnormality in the abnormal link. This facilitates subsequent abnormal processing of link node a.

[0112] In summary, the target abnormal link corresponding to the microservice business is determined based on the target abnormal link data, and then the abnormal link node in the target abnormal link is determined, thereby improving the accuracy of abnormal link node determination.

[0113] Furthermore, after the abnormal link node is determined, considering that the abnormal node will lead to the normal operation of the microservice business, it is necessary to perform subsequent abnormal feedback and abnormal processing on the abnormal link node, which is specifically implemented as follows:

[0114] Generate abnormal information based on the abnormal link node; and feed back the abnormal information to an information receiver corresponding to the microservice business.

[0115] Specifically, the abnormal information may include information such as the link node identifier of the abnormal link node, the abnormal type, and the abnormal time; the information receiver may be a client or user who performs root cause location.

[0116] Based on this, the abnormal type and abnormal time of the abnormal link node are determined, and abnormal information is generated based on the link node identifier, abnormal type, abnormal time and other information of the abnormal link node. The abnormal information is fed back to the information receiver corresponding to the microservice business.

[0117] Using the above example, after the abnormal link node is determined, the link node label P of the abnormal link node and the abnormal type of the abnormal link node are determined: calculation abnormality and the time when the abnormality occurred. According to the node label P of the abnormal link node, the calculation abnormality and the time when the abnormality occurred, the abnormal information is generated and sent to the client or user.

[0118] In summary, by obtaining the historical link data corresponding to the microservice business and determining the target anomaly location model corresponding to the historical link data; determining the to-be-processed link data set corresponding to the microservice business, clustering the to-be-processed link data set, and determining the cluster center link data according to the clustering results; inputting the cluster center link data into the target anomaly location model to obtain the abnormal link node information corresponding to the cluster center link data; determining the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determining the abnormal link node in the target abnormal link. Based on the initial anomaly location model, the model is fine-tuned, so that the adjusted initial anomaly location model is applicable to specific microservice businesses, so that the initial anomaly location model has a wider applicability and stronger generalization ability; when locating the root cause through the target anomaly location model, the cluster center link data is selected for root cause location to improve the root cause location speed of the microservice business.

[0119] The following combination Figure 3 , taking the application of the root cause location method provided in this specification in root cause location as an example, the root cause location method is further described. Figure 3 A process flow chart of a root cause location method provided by an embodiment of the present specification is shown, which specifically includes the following steps.

[0120] With the development of computer technology, microservices on the cloud are developing rapidly. Microservice architecture is a highly scalable, highly available, and easy to maintain and update service architecture. The continuous expansion of microservice scale makes the RPC dependency graph complex, exacerbates the tail-of-scale effect, and makes many empirical rules unreliable. Previous work on microservice performance debugging is based on correlation, empirical thresholds, or non-scalable algorithms and deep learning models. None of them use microservice benchmarks with comparable production service scales for quantitative evaluation, making their accuracy and performance questionable in production-scale microservices. When microservices scale, many heuristic methods for root cause analysis algorithms based on experience and rules become unreliable or even unverifiable.

[0121] In the prior art, the work on microservice performance debugging is based on correlation, empirical thresholds or non-scalable algorithms and deep learning models, resulting in low accuracy and slow speed. When microservices are expanded, the algorithms that locate the root cause based on experience and rules become unreliable or even unable to locate the root cause. Therefore, new methods are needed to locate the root cause of the fault when a fault occurs. In order to perform root cause diagnosis on the trace data of microservices in a production environment and improve the efficiency of problem solving, this embodiment provides a root cause location method.

[0122] Step S302: determining at least two initial microservices, and collecting at least two link data corresponding to the at least two initial microservices respectively according to a preset data collection strategy.

[0123] In order to improve the richness of data samples, when collecting link data, collect Trace data from different business systems, which can improve the generalization ability of the later model. Figure 4 As shown, when collecting data, the stock data generated by multiple business systems are obtained and the stock data is used as the original Trace data. The collection of link data can be implemented by OpenTelemetry (distributed link tracking standard).

[0124] Step S304: Divide at least two link data corresponding to at least two initial microservice businesses respectively according to a preset data division rule, and construct a link data set to be trained according to the division result.

[0125] Since the amount of original trace data collected is large, it is necessary to divide the link data in the business system according to the Service dimension and sample it according to a certain distribution based on the running time of the service, so that the training samples can cover all service nodes and as many trace data forms as possible.

[0126] Step S306: Encoding the link data to be trained in the link data set to be trained, and determining the text vector corresponding to the link data to be trained according to the processing result.

[0127] Perform feature engineering on the original trace data. Feature engineering includes steps such as text vectorization, span exclusive time, error state determination, and span exclusive time normalization. In the text vectorization step, the SBert model is used to process the original trace data to achieve text-to-vector conversion.

[0128] Step S308: Determine the time information and state information corresponding to the link data to be trained in the link data set to be trained.

[0129] Calculate the exclusive time of the Span in the Trace data and the real state of the Span as label information for subsequent model training. By processing the Trace data of the Open Telemetry protocol, use the SpanID and parentSpanID in the data to build an RPC Dependency Graph (remote procedure call dependency graph), and rename the dependency graph with the corresponding (Service, name, kind). The start time (startTime), end time (endTime), duration (duration), and status code (status Code) of the Trace will be actively obtained here.

[0130] Encode the service and name in the trace data with semantic information (converted into a 768-dimensional vector using SBert). When encoding, remove special characters, hexadecimal encoding, and convert uppercase and lowercase letters uniformly. Calculate the span exclusive time. The duration of the synchronization span of non-leaf nodes includes the time spent in the service and the waiting time of its child spans. Separating the self-duration from the waiting time can help us locate the root cause of high-latency traces, because the span's own duration can be used to predict the potential amount of time saved, that is, how much time can be saved if the performance issues related to the span are alleviated. Figure 4 The exclusive time of the parent span (P) is (T1-T0)+(T5-T4), the exclusive time of span (A) is T3-T1, and the exclusive time of span (B) is T4-T2. Span duration transformation: The duration values ​​are scaled using a logarithmic transformation with a base of 10. In addition, they are normalized using a global mean of 4.0 and a standard deviation of 1.0 so that the anomaly localization model can be directly applied to the tracking dataset without rescaling.

[0131] Step S310: construct link data samples corresponding to the link data to be trained based on the time information, the state information and the text vector, and form a link data sample set.

[0132] Figure 4 In the figure, a feature is described in detail. In the graph structure, 1, 2, and 3 represent Service, operation, and kind, respectively; 4 and 5 represent SpanID and parent SpanID, respectively; 6, 7, 8, and 9 represent start, end, duration, and status, respectively. The graph structure is a Trace data sample.

[0133] Step S312: train the anomaly localization model to be trained using the link data sample set until an initial anomaly localization model that meets the training stop condition is obtained.

[0134] The GIN model is trained using a sample set of link data to obtain an anomaly location model with generalization capabilities. Anti-real-time queries are generated to locate the root cause of abnormal trace links. CBN (Causal Bayesian Networks, a causal inference network based on Bayesian theory) is used to characterize the propagation of error information in trace data. GIN (Graph Isomorphism Network) is used to embed and encode trace link data, and learning is performed through a specific loss function to finally complete the learning of embedded features. Counterfactual methods are used for root cause analysis. Counterfactual queries refer to what the expected tracking duration and error status are if certain spans are restored to normal under certain circumstances. In other words, this query is based on a hypothetical situation, that is, assuming that certain spans are in a normal state, how will the entire system operate.

[0135] Step S314: Obtain historical link data corresponding to the microservice business, and update the initial abnormality location model to the target abnormality location model based on the historical link data.

[0136] After obtaining the initial anomaly location model with the ability to locate the root cause of the anomaly, the application of the initial anomaly location model can be realized. Figure 5 As shown, the stock data under the microservice business is obtained as the historical link data for fine-tuning the initial anomaly location model. The initial anomaly location model is fine-tuned by combining the stock data and the log data stored in the log storage to implement model pre-training and obtain a new model suitable for the current microservice business, namely the target anomaly location model.

[0137] Step S316: Determine the to-be-processed link data set corresponding to the microservice business, and determine the to-be-processed link data included in the to-be-processed link data set.

[0138] When performing Trace root cause diagnosis, link data is collected in real time, and the collected link data is filtered based on specific filtering conditions to obtain candidate data. Based on the candidate data, a data set of links to be processed that need to be diagnosed for root cause in the microservice business is constructed.

[0139] Step S318: clustering the link data set to be processed, and determining the cluster center link data according to the clustering result.

[0140] A specific clustering algorithm is used to cluster the candidate data and obtain candidate data for each cluster center. The span identifier consists of its label: (Service, name, kind) tuple, its error state and the labels of all ancestor spans within a maximum distance of d_max to reflect the structure and state of a given trace. Different spans that share the same identifier are merged in a set, and their weight is equal to the sum of their durations. When the structure and execution state of two traces are similar, the same elements with similar weights can be found in the two trace sets. We use the extended Jaccard index to calculate the similarity of trace sets. , Use the DBSCAN algorithm for clustering to obtain trace clusters with similar structures, and find representative (cluster center) trace links from them as trace links to be analyzed for root causes.

[0141] Step S320: input the cluster center link data into the target anomaly positioning model to obtain the abnormal link node information corresponding to the cluster center link data.

[0142] The new model obtained after updating the initial anomaly location model is loaded, and the candidate data of each cluster center is inferred based on the new model to achieve the root cause location of each cluster center candidate data.

[0143] Step S322: Determine the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine the abnormal link node in the target abnormal link.

[0144] After determining the abnormal link nodes corresponding to the candidate data of each cluster center, determine the abnormal link nodes where the abnormality is located, and perform abnormal processing on the abnormal nodes, or record the abnormal information.

[0145] In practical applications, microservices can also be synthesized to provide larger-scale verification data. In open source data, the microservice systems that can be found are not complex, and the types of service nodes involved are very small, which cannot accurately reflect the scale and complexity of microservice systems in real production environments; for limited evaluation microservice systems, it is also impossible to accurately evaluate the capabilities of each evaluation system. For this reason, a microservice generation system was written during the experimental evaluation phase, which can support the generation of microservice systems with complex network structures and provide common fault injection methods.

[0146] like Figure 6 As shown in the figure, several Services (0-9) are generated first, and RPCs are assigned to different Services to form the entire microservice system. It randomly marks a service as a frontend, middleware, backend, and leaf node, and these services have different positions and fan-outs in the RPC dependency graph. A set of commonly used service and RPC names are also collected and assigned to Services and RPCs to make their semantics in the Trace link data more realistic. The above-generated Services and RPCs are used to generate a logical RPC dependency graph according to some strategies. The execution graph describes the order and dependencies of child RPCs called by the same parent node. The edge from the parent RPC to the child RPC indicates that the child RPC can be called directly by the parent node without waiting for the results of any other child RPCs. The edge between two child RPCs means that the target RPC can be called only after receiving and processing the response of the source RPC. Through the above steps, a microservice system can be generated more clearly, different types of services (traffic nodes, disk IO intensive nodes, computing intensive nodes, etc.) are attached to each node, and the above microservice system is deployed on the cloud platform. With the help of relevant data collectors, subsequent algorithm verification can be carried out.

[0147] In this example, a GNN-based model is designed to identify root causes in microservices, which is better than previous work in terms of accuracy, performance, and flexibility, especially at large scale. A distance metric is proposed to measure the similarity between two traces for clustering. This metric is able to distinguish traces with different call paths and failure modes. To quantitatively evaluate the proposed method in production-scale microservices, an evaluation method is designed using synthetic benchmark generation. This benchmark can be generated at any scale and deployed in a k8s cluster to mimic the behavior of real production services.

[0148] In summary, by obtaining the historical link data corresponding to the microservice business and determining the target anomaly location model corresponding to the historical link data; determining the to-be-processed link data set corresponding to the microservice business, clustering the to-be-processed link data set, and determining the cluster center link data according to the clustering results; inputting the cluster center link data into the target anomaly location model to obtain the abnormal link node information corresponding to the cluster center link data; determining the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determining the abnormal link node in the target abnormal link. Based on the initial anomaly location model, the model is fine-tuned, so that the adjusted initial anomaly location model is applicable to specific microservice businesses, so that the initial anomaly location model has a wider applicability and stronger generalization ability; when locating the root cause through the target anomaly location model, the cluster center link data is selected for root cause location to improve the root cause location speed of the microservice business.

[0149] Corresponding to the above method embodiment, this specification also provides a root cause locating device embodiment, Figure 7 FIG. 2 shows a schematic diagram of the structure of a root cause location device provided by an embodiment of the present specification. Figure 7 As shown, the device comprises:

[0150] The acquisition module 702 is configured to acquire historical link data corresponding to the microservice business, and update the initial anomaly location model to a target anomaly location model based on the historical link data;

[0151] The clustering module 704 is configured to determine a to-be-processed link data set corresponding to the microservice business, cluster the to-be-processed link data set, and determine cluster center link data according to the clustering result;

[0152] An input module 706 is configured to input the cluster center link data into the target anomaly positioning model to obtain abnormal link node information corresponding to the cluster center link data;

[0153] The determination module 708 is configured to determine the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine the abnormal link node in the target abnormal link.

[0154] In an optional embodiment, the acquisition module 702 is further configured to:

[0155] The initial anomaly location model is updated to a target anomaly location model corresponding to the historical link data; wherein the training of the initial anomaly location model comprises: determining a link data set to be trained based on at least two initial microservice businesses; constructing a link data sample set based on at least two link data to be trained contained in the link data set to be trained;

[0156] The link data sample set is used to train the anomaly location model to be trained until an initial anomaly location model that meets the training stop condition is obtained.

[0157] In an optional embodiment, the acquisition module 702 is further configured to:

[0158] The link data to be trained is converted into a text vector, and the time information and state information of the link data to be trained are determined; the text vector is updated based on the time information and the state information, and a link data sample corresponding to the link data to be trained is constructed based on the updated text vector.

[0159] In an optional embodiment, the acquisition module 702 is further configured to:

[0160] Determine at least two initial microservice businesses; collect at least two link data corresponding to the at least two initial microservice businesses according to a preset data collection strategy; divide the at least two link data corresponding to the at least two initial microservice businesses according to a preset data division rule, and determine a subset of link data to be trained corresponding to each initial microservice business according to the division result; and construct a link data set to be trained based on the at least two subsets of link data to be trained.

[0161] In an optional embodiment, the acquisition module 702 is further configured to:

[0162] The link data to be trained is encoded, and a text vector corresponding to the link data to be trained is determined according to the processing result; the start time and the end time of the sub-link data contained in the link data to be trained are calculated, and the time information corresponding to the link data to be trained is determined according to the calculation result; and the sub-state information of the sub-link data contained in the link data to be trained is used as the state information of the link data to be trained.

[0163] In an optional embodiment, the input module 706 is further configured to:

[0164] At least two pieces of to-be-processed link data corresponding to the microservice business are acquired based on a preset data acquisition strategy; and a to-be-processed link data set is constructed using the at least two pieces of to-be-processed link data.

[0165] In an optional embodiment, the input module 706 is further configured to:

[0166] Determine the link data to be processed contained in the link data set to be processed; cluster the link data set to be processed according to the data structure, link state and time weight of each link data to be processed in the link data set to be processed, and determine the cluster center link data according to the clustering result.

[0167] In an optional embodiment, the determining module 708 is further configured to:

[0168] Based on the abnormal link node information, target abnormal link data is determined in the link data set to be processed; based on the target abnormal link data, a target abnormal link corresponding to the microservice business is determined; based on the abnormal link node information, an abnormal link node is determined in the target abnormal link.

[0169] In an optional embodiment, the determining module 708 is further configured to:

[0170] Generate abnormal information based on the abnormal link node; and feed back the abnormal information to an information receiver corresponding to the microservice business.

[0171] In summary, by obtaining the historical link data corresponding to the microservice business and determining the target anomaly location model corresponding to the historical link data; determining the to-be-processed link data set corresponding to the microservice business, clustering the to-be-processed link data set, and determining the cluster center link data according to the clustering results; inputting the cluster center link data into the target anomaly location model to obtain the abnormal link node information corresponding to the cluster center link data; determining the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determining the abnormal link node in the target abnormal link. Based on the initial anomaly location model, the model is fine-tuned, so that the adjusted initial anomaly location model is applicable to specific microservice businesses, so that the initial anomaly location model has a wider applicability and stronger generalization ability; when locating the root cause through the target anomaly location model, the cluster center link data is selected for root cause location to improve the root cause location speed of the microservice business.

[0172] The above is a schematic scheme of a root cause locating device of this embodiment. It should be noted that the technical scheme of the root cause locating device and the technical scheme of the root cause locating method described above are of the same concept, and the details not described in detail in the technical scheme of the root cause locating device can be referred to the description of the technical scheme of the root cause locating method described above.

[0173] Corresponding to the above method embodiment, this specification also provides a root cause positioning system embodiment. Figure 8 is an architecture diagram of a root cause positioning system provided by an embodiment of the present specification, the root cause positioning system 800 includes a server 810 and a client 820;

[0174] The client 820 submits an exception location request to the server 810 for the target microservice business;

[0175] The server 810 parses the abnormal location request to obtain debugging link data and target link data; updates the initial abnormal location model to the abnormal location model to be used based on the debugging link data; clusters the target link data, and determines the link data to be input according to the clustering result; inputs the link data to be input into the abnormal location model to be used, and obtains abnormal node information corresponding to the target microservice business; determines the abnormal node based on the abnormal node information, and generates abnormal feedback information based on the abnormal node and the abnormal node information; sends the abnormal feedback information to the client 820 as a response to the abnormal location request;

[0176] The client 820 performs exception processing on the target microservice business based on the exception feedback information.

[0177] In actual applications, the client corresponds to any demand side that has a need to locate the root cause of a microservice. The demand side submits an exception location request to the server by operating the client. The server obtains the debugging link data and the target link data after parsing the exception location request; the debugging link data is used to fine-tune the initial exception location model so that the prediction capability of the adjusted initial exception location model can achieve the abnormal location of the link data of the target microservice business. The initial exception location model is updated to the to-be-used exception location model based on the debugging link data. The target link data is clustered, and the to-be-input link data is determined according to the clustering results. The to-be-input link data is input into the to-be-used exception location model to obtain the abnormal node information corresponding to the target microservice business. The abnormal node is determined based on the abnormal node information, and abnormal feedback information is generated based on the abnormal node and the abnormal node information. The abnormal feedback information is sent to the client as a response to the abnormal location request. After receiving the abnormal feedback information, the client can perform abnormal processing on the target microservice business based on the abnormal feedback information, wherein the abnormal processing includes but is not limited to recovering the abnormality, recording the abnormality type and the abnormality cause, and sending the abnormal feedback information to the abnormality processing personnel.

[0178] In summary, the model is fine-tuned based on the initial anomaly localization model, so that the adjusted initial anomaly localization model is suitable for specific microservice businesses, making the initial anomaly localization model have wider applicability and stronger generalization ability; when locating the root cause through the target anomaly localization model, the cluster center link data is selected for root cause localization to improve the root cause localization speed of the microservice business.

[0179] Fig. 9The block diagram of a computing device 900 according to an embodiment of the present specification is shown. The components of the computing device 900 include but are not limited to a memory 910 and a processor 920. The processor 920 is connected to the memory 910 via a bus 930, and a database 950 is used to store data.

[0180] The computing device 900 also includes an access device 940 that enables the computing device 900 to communicate via one or more networks 960. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 940 may include one or more of any type of network interface (e.g., a network interface card (NIC)) that is wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0181] In one embodiment of the present specification, the above components of the computing device 900 and Fig. 9 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Fig. 9 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0182] The computing device 900 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 900 may also be a mobile or stationary server.

[0183] The processor 920 is used to execute the following computer executable instructions, which, when executed by the processor, implement the steps of the above-mentioned root cause location method.

[0184] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the root cause location method described above are of the same concept, and the details not described in detail in the technical scheme of the computing device can be found in the description of the technical scheme of the root cause location method described above.

[0185] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which can implement the steps of the above-mentioned root cause location method when executed by a processor.

[0186] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the root cause location method described above are of the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the root cause location method described above.

[0187] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned root cause locating method.

[0188] The above is an illustrative solution of a computer program of this embodiment. It should be noted that the technical solution of the computer program and the technical solution of the root cause location method described above are of the same concept, and the details not described in detail in the technical solution of the computer program can be found in the description of the technical solution of the root cause location method described above.

[0189] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0190] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0191] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0192] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0193] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A root cause location method, comprising: Obtain historical link data corresponding to the microservice business, and determine a target anomaly location model corresponding to the historical link data; Determine a link data set to be processed corresponding to the microservice business, cluster the link data set to be processed, and determine cluster center link data according to the clustering result; Inputting the cluster center link data into the target anomaly positioning model to obtain abnormal link node information corresponding to the cluster center link data; A target abnormal link corresponding to the microservice business is determined based on the abnormal link node information, and an abnormal link node is determined in the target abnormal link.

2. According to the method of claim 1, the step of determining a target anomaly location model corresponding to the historical link data comprises: The initial anomaly location model is updated to a target anomaly location model corresponding to the historical link data; wherein the training of the initial anomaly location model comprises: determining a link data set to be trained based on at least two initial microservice businesses; constructing a link data sample set based on at least two link data to be trained contained in the link data set to be trained; and using the link data sample set to train the anomaly location model to be trained until an initial anomaly location model that meets the training stop condition is obtained.

3. The method according to claim 2, wherein the construction of any one link data sample in the link data sample set comprises: Convert the link data to be trained into a text vector, and determine the time information and state information of the link data to be trained; The text vector is updated based on the time information and the state information, and a link data sample corresponding to the link data to be trained is constructed based on the updated text vector.

4. The method according to claim 2, wherein determining the link data set to be trained based on at least two initial microservice businesses comprises: Identify at least two initial microservices. Collect at least two link data corresponding to at least two initial microservice businesses respectively according to a preset data collection strategy; Divide at least two link data corresponding to at least two initial microservice businesses respectively according to a preset data division rule, and determine a link data subset to be trained corresponding to each initial microservice business according to the division result; A link data set to be trained is constructed based on at least two link data subsets to be trained.

5. The method according to claim 3, wherein converting the link data to be trained into a text vector and determining the time information and state information of the training link data comprises: Performing encoding processing on the link data to be trained, and determining a text vector corresponding to the link data to be trained according to the processing result; Calculating the start time and end time of the sub-link data included in the link data to be trained, and determining the time information corresponding to the link data to be trained according to the calculation result; The sub-state information of the sub-link data included in the link data to be trained is used as the state information of the link data to be trained.

6. According to the method of claim 1, the step of determining the to-be-processed link data set corresponding to the microservice business comprises: Acquire at least two to-be-processed link data corresponding to the microservice business based on a preset data acquisition strategy; A link data set to be processed is constructed using at least two link data to be processed.

7. The method according to claim 1, wherein clustering the link data set to be processed and determining the cluster center link data according to the clustering result comprises: Determining the link data to be processed contained in the link data set to be processed; The link data sets to be processed are clustered according to the data structure, link state and time weight of each link data to be processed in the link data sets to be processed, and cluster center link data is determined according to the clustering result.

8. The method according to claim 1, wherein determining the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determining the abnormal link node in the target abnormal link, comprises: Determine target abnormal link data in the link data set to be processed based on the abnormal link node information; Determine the target abnormal link corresponding to the microservice business based on the target abnormal link data; An abnormal link node is determined in the target abnormal link based on the abnormal link node information.

9. The method according to claim 1, after the step of determining abnormal link nodes in the target abnormal link is performed, further comprising: Generate abnormal information based on the abnormal link node; The abnormal information is fed back to the information receiver corresponding to the microservice business.

10. A root cause location system, comprising a server client; The client submits an exception location request to the server for the target microservice business; The server parses the abnormality location request to obtain debugging link data and target link data; based on the debugging link data, updates the initial abnormality location model to the abnormality location model to be used; Clustering the target link data, and determining link data to be input according to the clustering result; Input the link data to be input into the abnormal location model to be used to obtain abnormal node information corresponding to the target microservice business; determining an abnormal node based on the abnormal node information, and generating abnormal feedback information based on the abnormal node and the abnormal node information; Sending the abnormality feedback information to the client as a response to the abnormality location request; The client performs exception processing on the target microservice business based on the exception feedback information.

11. A root cause locating device, comprising: An acquisition module is configured to acquire historical link data corresponding to the microservice business and determine a target anomaly location model corresponding to the historical link data; A clustering module is configured to determine a data set of links to be processed corresponding to the microservice business, cluster the data set of links to be processed, and determine cluster center link data according to the clustering result; An input module is configured to input the cluster center link data into the target anomaly positioning model to obtain abnormal link node information corresponding to the cluster center link data; The determination module is configured to determine a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine an abnormal link node in the target abnormal link.

12. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the root cause locating method according to any one of claims 1 to 9 are implemented.

13. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the steps of the root cause locating method according to any one of claims 1 to 9.

Images